Workday: X509 Certificate
Updated at August 31st, 2026
If a Workday client requests that an X509 certification be used for signing requests made to Workday, the following must be completed:
- Send the public key to the client, this can be re-used in PROD and STG.
- The client will then need to provide a username to be used in the payload.
- You will need use the following node for the signature:
<ds:Signature Id="placeholder"></ds:Signature>
Sample Payload
<?xml version="1.0" encoding="UTF-8"?>
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<env:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken>
<wsse:Username>{USERNAME GOES HERE}</wsse:Username>
</wsse:UsernameToken>
<ds:Signature Id="placeholder"></ds:Signature>
</wsse:Security>
</env:Header>
<env:Body>
<wd:Move_Candidate_Request xmlns:wd="urn:com.workday/bsvc" wd:version="v41.0">
<wd:Dynamic_Business_Process_Parameters>
<wd:Next_Step_Reference>
<wd:ID wd:type="Workflow_Step_ID">{{__journey_candidate_status|mapvalue('statusUpdate')}}</wd:ID>
</wd:Next_Step_Reference>
</wd:Dynamic_Business_Process_Parameters>
<wd:Move_Candidate_Data>
<wd:Job_Application_Reference>
<wd:ID wd:type="WID">{{__ex_id_1}}</wd:ID>
</wd:Job_Application_Reference>
</wd:Move_Candidate_Data>
</wd:Move_Candidate_Request>
</env:Body>
</env:Envelope>The <ds:Signature Id="placeholder"></ds:Signature> will be translated after the payload is sent, so you won’t be able to see it in the Integration Center's preview.
You can run a test by sending to a test endpoint here.